The built-in auditing for permission changes is handled through "Audit object access". If you look at the types of auditing that you can configure on a filesystem object you'll see that "Change Permissions" is one of the auditable items.
You're going to find that the log data generated by "Audit object access" is painfully verbose and difficult to parse, though. The actual permissions change (a "WRITE_DAC" event-- DAC meaning "Discretionary Access Control") will only reference a handle ID, so you'll have to parse backwards from the WRITE_DAC to find the handle open event. That event will tell you the name of the object being modified by the WRITE_DAC. Rather tiresome...
I had one Customer who explored using the CPTRAX File System Audit Trails for Windows utility for a similiar situation. I don't believe they ever actually implemented it, but as part of their exploration I reviewed the documentation and found that it appeared to be "sane", at least. I can't give any kind of personal recommendation for it, but it looked like it would do what the manufacturer claimed.
I had a few minutes tonight, so I wrote a crazy, painful CMD script to track permission changes. Parsing the event log is painful (and really requires a state machine to get it right), so this is a second-best attempt.
The script expects to be passed the filename of a file to track the permissions on, and a path and "base" filename of a file to store the permissions observed in. Let's assume a fake set of arguments:
perm-track.cmd "C:\Program Files\Some Application\File To Track.exe" "C:\Permission Tracker\File to Track.exe"
The first time the script runs (at, say, 12:51:30 on July 18, 2010) the permissions set on "C:\Program Files\Some Application\File To Track.exe" will be stored in the file "C:\Permission Tracker\File to Track.exe.20100718_125130.permissions.txt".
The next time the script is run, with the same arguments, the permissions stored in the most recently-created "C:\Permission Tracker\File to Track.exe.*.permissions.txt" file will be compared against the current permissions on "C:\Program Files\Some Application\File To Track.exe". If there's a change, the new permissions will be stored in an appropriately named "File to Track.exe.ISODATE.permissions.txt" file in "C:\Permission Tracker".
Wiring this up to send emails would be pretty easy. Running it as a scheduled task, or in a loop would be pretty easy, too.
This is definitely quick-and-dirty, and it probably has bugs, but this script might do what you need.
if "%~1"=="" goto syntax
if not exist "%1" goto syntax
if "%~2"=="" goto syntax
rem Get an ISO date (working around shell silliness re: hours earlier than 10:00)
SET /A HOUR=%TIME:~0,2%
rem Save current permissions into a temporary file
cacls %1 >%TEMPFILE%
rem Get filename of last set of permissions reported
for /f "usebackq delims=" %%f in (`dir /od /b /s "%~2*.permissions.txt"`) do SET LASTFILE=%%f
rem Was there no last file? If so, put current temp file in place
if "%LASTFILE%"=="" (
move %TEMPFILE% "%~2.%ISODATE%.permissions.txt"
) else (
rem Compare current permission to last permission-- if it's different, annotate current permission
fc %TEMPFILE% "%LASTFILE%"
if errorlevel 1 move %TEMPFILE% "%~2.%ISODATE%.permissions.txt"
echo Really, really poor man's permission change tracker.
echo Call with path of file to monitor on command-line as first argument,
echo path and base filename to store "report" files of permission changes
echo as the second argument.
echo perm-track.cmd "C:\Program Files\Some Application\File To Track.exe" "C:\Permission Tracker\File to Track"